The Role of AI and Automation
- 1. The Role of AI and Automation in Helping Internal Audit Identify and Assess Emerging Risks Steve Biskie, Director, RSM Manuel Coello, Director, CVS Health
- 2. AGENDA ā¢ Audit of the future vs. the audit of today ā¢ Supporting technologies and processes ā¢ Making it work in real life ā¢ Getting your own program off the ground
- 3. Introductions Steve Biskie Manuel Coello 50 years combined analytics & automation experience RSM steve.biskie@rsmus.com CVS Health CoelloM@aetna.com
- 4. Polling Question 1 Please open the conference app to participate
- 5. Polling Question Where are you currently in your journey to a mature automation program within IA a. Just getting started b. c. Good progress, but much more to accomplish d. e. Mature, stable process covering the majority of our risks Please show in a bar graph
- 6. Audit of the future vs. the audit of today
- 7. What does the audit of the future look like? As an auditor, my day starts with: 1. Notifications of any significant risk changes that occurredovernight ā¢ The risks themselves ā¢ The tools management uses tomonitor risks 2. Options for how those risk changes might influence my day/week 3. Actioning the ānext stepsā of any testing that could not be fully automated 4. Discussions with management and other experts about emerging risks and indicators that could be used to enhance risk monitoring ā¦and my day ends with: 1. Planning the next phase of audit optimization 2. Adjusting/training my army of audit bots as new information is learned 3. Pressing the ādo auditā button as I head home Ā©2019 RSM USLLP.All RightsReserved. One Audit = One Day Data-DrivenStories build Insight Speed/Value/Quality
- 8. IIA Audit Executive Center 2017 North American Pulse of Internal Audit Survey
- 9. IIA Audit Executive Center 2017 North American Pulse of Internal Audit Survey āCAEs are often eager to use data analytics becauseit enables them to look at large volumesof data and quickly identify nonconformingactivities or outliers. Leveragingthe vast amount of data available in most organizationscan enhancethe capacity andimpact of internal audit, instilling confidencein internal audit among our key stakeholders. These potential benefits may compel CAEs to implement data analytics, even when the needed structuresand processes are not fully in place. Pulse results suggest that if CAEs were to audit their own data analytics practices, many would not have positive results.ā
- 10. āEmerging Riskā both strategic and granular Strategic ļ----------------Risks can be identified anywhere in the audit process. ---------------ā Granular
- 11. Polling Question 2 Please open the conference app to participate
- 12. Polling Question Where do you see the largest untapped value for applying automation a. Risk Assessment b. Audit Planning c. Fieldwork d. Reporting e. Post-Audit Follow-up Please show in a pie chart graph
- 13. The Need for InnovativeAuditing Risk Analytics Answer questions about past, present, and future ā¢ IFTTT, SoD, and business rules ā¢ Data visualization ā¢ Process mining ā¢ Risk scoring, modeling, and statistics ā¢ Text mining, machine learning, and AI RPA Automate and routinize key audit tasks ā¢ Scheduled jobs ā¢ Low cognitive task automation ā¢ Cross-application āmacrosā ā¢ Manual, repetitive or high volume tasks ā¢ Higher-order task automation (w ith AI) Agile Organize, prioritize and deliver on audits ā¢ Risk backlog vs defined plan ā¢ Quick sprints, adaptable to changes ā¢ Incremental w orkvs all at once ā¢ Increased information and communication flow ā¢ Client collaboration
- 14. Supporting technologies and processes
- 15. Reality Check: Weāve had the tools for awhileā¦ ā¢ Internal Audit Automation has actually been around for decades ā¢ Traditional audit technologies helped to automate data analysis procedures ā¢ PC-integrated technologies helped to automate tasks ā¢ Newer Robotic Process Automation (RPA) technologies automate where back-end system access is unavailable
- 16. RPA Overview Robotic Process Automation (āRPAā) RPA refers to a set of modular software programs (or ābotsā) to complete structured, repeatable, and logic- based tasks by mimicking the actions taken by existing human staff. ā¢ Developed bots are capable of interacting with and integrating disparate enterprise applications, databases, and files to limit the business need to develop custom, application specific integrations. ā¢ A set of scheduled bots are capable of running on multiple servers within a companyās environment simultaneously with minimal impact to resource and network capacity. RPA Value Proposition Across industries, RPA enables organizations of all sizes to efficiently scale operations with minimal impact to existing business processes.
- 17. IA/ComplianceAutomation: The complete toolbox
- 18. Making it work in real life
- 19. Re-thinking the Audit Analytics Model DATA RPA AI+ + + DO ANALYTICS = ASSURANCE THINK ANALYZEGET VALUE OrganizationOperationTools DigitalWorkforce
- 20. Mindset Startwith capabilitiesthendeploy to auditprojects Intentional Daily scrumswith 2-week sprintsarranged to deliverto thecustomer Experimental Data ScienceLab approach- donātmix undeveloped capabilitieswith activeaudits Commitment Resources& fundsdedicated to Analytics,Automation,RPAandAI Authority to decideourown projects Autonomy LeverageCorporateResources Resourceful Capability based 1 32 4 65 ā¢ Risk & predictive modeling ā¢ Natural Language Processing ā¢ Geospatial analytics ā¢ In-database analytics ā¢ Unsupervised models ā¢ OCR & encryption ā¢ Unstructured data ā¢ Robotics ā¢ Dashboarding ā¢ Self-Service
- 21. Robotic Process Automation VALUE Maturity Level AUDIT PROCESS MATURITY DATA COLLECTION EFFECTIVENESS META-BOTS Basic Enhanced Intelligent ELI-1 ā Preparesa dashboard with30+ descriptive analyticsin5 minutes Penny - Logs intothe systemsand traces transaction IDs and extracts 10+ support docs and puts it in a single PDF ELI-2 ā Intelligentauditornotifications(auditplanprogress,IT charges, earlyanalytics exceptions,etc.) Ron ā Verifiesanddocumentsthat automatedprocesseswere executedasintended Lucy - Manages data requests (In development) Angela ā Navigatesthrougha systemand extracts customer correspondence Luca ā Logs intobank websitesandextractscustomer payment information Webster ā Web scrapper that crawls through relevantinformation containedin a website AUDIT PROCESS DATA COLLECTION EFFECTVENESS ELI1 Penny Angela Luca Webster ELI2 Ron Lucy PDfer Filer
- 22. AI / Machine Learning VALUE Maturity Level Supervised MATURITY Semi-Supervised Unsupervised Other Basic Enhanced Intelligent Risk Scores ā Assessesa transaction riskfrom 1 to 100 Fraud Scores ā Assessesa fraudrisk from 1 to 100 Correlations ā Relationshipbetweenmultiple variables Prediction Scores ā Calculatesthe audit exceptionprobabilityscore from 1 to 100 Clustering ā Groups unlabeleddatainto similarclusters Auto-Encoding ā Re-construct data usingartificial neural network Kamila Cluster Modelā Clustergroups based on a riskpattern Text Mining ā Investigative fraudmodel usingemails SUPERVISED SEMI-SUPERVISED UNSUPERVISED Risk Score Models Prediction Score Models Correlations NLP Spatial Analytics Auto-Encoding Fraud Models Clustering NLP ā Structuresdata from free formtext or phone recordings Spatial ā Re-construct data usingartificial neural network Other Kamila Clustering Text Mining
- 23. Putting everything togetherā¦ Risky T&E Transaction ANALYTICS RPA AI / Machine Learning Transaction Source System Audit DW DataEnrichment - MCCs - Org Details - Demographics DataValidation Testing rules to validate the data Merchant Info Webster obtained additional detailsfrom a website about the merchant Descriptive Analytics
- 24. Putting everything togetherā¦ ANALYTICS RPA AI / Machine Learning PrescriptiveAnalytics Risk Scoring Prediction 20+ Audit Tests EarlyWarning UnsupervisedValidation Ron validatessuccess of the automated feed and documents completenessand accuracy Prediction model uses historical audit findings to assess the likelihood of the transaction of being an exception Risk model uses quantitative and qualitativecalculationsto assess transaction risk ELI2 Identifiesa risky transaction and sendsan email with theanalysis Unsupervised models create clusters of entertainment and miscellaneousexpenses
- 25. Putting everything togetherā¦ ANALYTICS RPA AI / Machine Learning TracingDocumentsTransaction Selection Transaction selection leveragesrisk and prediction scores Penny grabs expense IDs, accesses Concur, takes key screenshots/receipts and consolidatesinto a PDF NLP NLP uses expense commentsentered by the employee, structures data and calculatesrisk Fraud Analytics Fraud modelsidentify risky employees SpatialAnalytics Recalculates the mileagesfrom two different points
- 26. Getting your own program off the ground
- 27. Typical Progression to Full Automation Opportunity identification & prioritization Micro-Task Automation Integrated Task Automation & Workflow RPA Pilot RPA Task Bots RPA Predictive Bots RPA Cognitive Bots āDo Auditā button Considerations ā¢ Access to underlying data ā¢ Process stability ā¢ External auditor expectations ā¢ Enterprise initiatives ā¢ Resource constraints ā¢ Quality of past process outcomes
- 28. 5 Immediate Steps you Can Take 1. Pick a starting point ā¢ Have data ā¢ Have knowledge (and can thus benchmark) ā¢ Likely to get management attention 2. Define KRIs (Key Risk Indicators) that you can measure ā¢ Using data you already have access to ā¢ Using data you can get access to quickly 3. Determine what can be automated immediately, and what should be automated longer-term 4. Establish a baseline and achievable success measures 5. Start a pilot ā¢ Fail quickly and learn fast
- 29. Polling Question 3 Please open the conference app to participate
- 30. Polling Question In a single word, what do you see as your biggest barrier to implementing automation and AI in your department? Please show in a Word Cloud
- 31. Summary ā¢ There should be no significant barriers to beginning your automation initiative TODAY ā¢ Consider quick-hit process improvement opportunities prior to automation ā¢ Recognize the tools in your toolbox that are right for the job ā¢ Prioritize low-risk, low-effort areas ā¢ Get started!
- 32. Q&A
- 33. TELL US WHAT YOU THINK! Evaluate this session right in the IIA Conference App! Not using the conference app? Visit: gam.cnf.io to complete your session evaluations.